June 9, 2014 by Paul G. | Migrated, Shield Security

Part 6, WordPress Automatic Updates – Shield WordPress Security Plugin

Shield Image

The WordPress automatic updates system has shipped with WordPress since version 3.7.

The Shield plugin helps administrators manage automatic updates to better suit their particular needs.

This automatic updates feature was added after the core WordPress development team opted to not offer a UI (user interface) against this feature.

In this article I’ll outline a what the WordPress automatic updates system is, how it works, and how exactly the Shield plugin assists administrators.

What is the WordPress Automatic Updates System?

When the Automatic Updates system was released, we wrote about it in detail here to help us all understand it a bit better. I suggest taking a read of that and then jumping back here.

In summary, automatic updates is a good thing. It ensures that WordPress minor releases, that typically apply security patches, are applied promptly to as many WordPress sites as possible.

There are many who disagree that automatic updates is a good thing, but for minor releases at least, we can see no harm in it.

How does the WordPress Automatic Updates System actually work?

There are 2 stages to the WordPress automatic updates system, and this causes a lot of confusion. It’s sometimes appears that their site isn’t automatically updating…

  1. WordPress detects the availability of an update
  2. WordPress runs the process to automatically apply detected updates

Both of these stages rely on the WordPress cron, and the WordPress cron relies on people visiting the site.  If no-one visits the site, the WordPress cron never runs.

So first of all, given the schedule that WordPress has created, it will query the availability of updates for the site.  This runs twice daily.

Then, on a separate schedule, it’ll apply any detected updates. This also runs twice daily.

Basically on the outside, it could take up to 24 hours before an update is detected and applied to a site by the automatic updates system (and that’s assuming you have visitors to the site to kick off the crons promptly).

How does Shield assist with WordPress Automatic Updates?

WordPress doesn’t automatically update everything, it only updates WordPress Core minor releases.

WordPress core developers have offered a detailed guide on how to configure the updates system if you want it to update other elements of a site, such as:

  • WordPress major releases
  • WordPress Plugins
  • WordPress Themes

You can also completely disable the automatic updates system if you want complete control over when it’ll run.

The Shield plugin let’s you turn on or off all automatic updates for all elements included in the WordPress background updates system.

Reviewing Shield’s Automatic Updates Options

The default settings of the plugin reflect the current WordPress default settings for automatic updates. In effect, enabling the automatic updates features of the plugin does nothing new except ensure that the plugin itself is kept up-t0-date.

Referring to the numbered options on the screenshot provided below, I’ll outline what they mean and what are the ideal settings:

Shield Security Options for Automatic Updates System Management
Shield Security Options for Automatic Updates System Management
Option 0: Turning on or off the whole Automatic Updates management feature

This option refers to the automatic updates management feature on the plugin – it does not refer to the WordPress Automatic Updates system (that’s the next option). If you want to use any of the other options on this page (to manage the WordPress automatic updates) then you need to turn on this option.

Option 1: Enable/Disables WordPress Automatic Updates

If you select this option it will completely turn off the whole WordPress Automatic Updates system. It doesn’t matter where else you might try to tweak settings, or if you use option within this plugin, you will completely disable the whole automatic updates system.

Option 2: Choose which WordPress core automatic updates are applied

By default, WordPress only applies updates for minor versions. With this option you can choose to never update the WordPress core automatically, or to apply major release updates as well as minor.

Options 3&4: Choose whether plugin and theme updates are automatically applied

When these options are selected, WordPress will automatically update any plugins or themes that it can. You need to use this option with care, as most plugin or theme updates should really be verified before being applied.

There are also other auto-update options available as shown on the screenshot provided below.

Shield Security Options for Automatic Updates System Management
Shield Security Options for Automatic Updates System Management
Option 5: Automatic Updates Delay Period

Shield Security will delay upgrades until the new update has been available for the set number of days. This helps ensure updates are more stable before they’re automatically applied to your site.

Option 6: Enable/Disable Automatic Plugin Self-Update

This refers to automatically updating the Shield plugin when a new update is released. This is highly recommended as it ensures Shield is running at the latest available secure version.

Option 7: Emails after automatic updates are applied

You can now specify who will, if you enable the option, receive email notifications when automatic updates are applied.

Who needs to manage Automatic Updates?

I think everyone should have a say in the updates that are applied to their sites. Not offering an options-interface to this critical feature on the part of the WordPress core development team is another step in the wrong direction. We are again forced under their will and their vision.

With iControlWP, you can also manage WordPress automatic updates, and even down to the granular level of selecting which plugins/themes are automatically updated. This implementation hasn’t made it into Shield due to its complexity. If that level of control is something you’re interested in, please sign-up for the free trial here and give it a go.

Hello dear reader!

If you want to level-up your WordPress security with ShieldPRO, click to get started today. (risk-free, with our no-quibble 14-day satisfaction promise!)

You'll get all PRO features, including AI Malware Scanning, WP Config File Protection, Plugin and Theme File Guard, import/export, exclusive customer support, and much, much more.

We'd be honoured to have you as a member, and look forward to serving you during your journey towards powerful, WordPress security.

Try ShieldPRO Today →

ShieldPRO Testimonials
@webmatpro's Gravatar @webmatpro

Thanks, awesome

Fully and awesome, thanks 🙂

@goldsmyth's Gravatar @goldsmyth

Essential plugin for any WP install

Met the folks behind this plugin at a recent WordPress meetup and have been using it on my WP installs ever since. The range of customisation and features is simply excellent. If you’re an expert, or if you’re new to security, the plugin can be as broad or precise as…

@desgio's Gravatar @desgio

Best Plugin to protect my website

I feel more secure after using this plugin at my website

@quietthunderdesigns's Gravatar @quietthunderdesigns

Works beautifully!

Have been using this plugin for a couple of years and it’s kept my site safe and secure!

Comments (3)

    you can enable or disable wordpress automatic update by adding two line code.

      Yep, you can. If you can code.

      This plugin lets you do a lot more than just enable or disable WordPress automatic updates.

      Thanks for your comment!

    Nice post.
    WordPress users can disable the WP Cron System by adding
    define(‘DISABLE_WP_CRON’, true);
    to your wp-config.php file, and use server cron or external cron service.

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese